QACraft

Reusable AI skills, safe installation lifecycle, and deterministic behavior evaluations for everyday software QA work.

QACraft 1.4.1 includes:

• 25 detailed QA workflow skills
• shared QA, evidence, security, approval, data, result, publication, and release policies
• generic, Codex, Claude Code, GitHub Copilot, Gemini CLI, and OpenCode project adapters
• preview-first install, verify, update, and uninstall commands
• versioned manifests, SHA-256 verification, rollback, and conflict protection
• deterministic structured-report evaluations for ten priority QA skills
• passing examples and targeted failure fixtures with declared expected results
• qacraft and python -m qacraft entry points
• verified self-contained wheel and source-distribution builds
• generated HTML documentation, schemas, examples, templates, tests, and release guidance

No third-party runtime Python packages are required. Python 3.10 or newer is supported.

Install from PyPI

python3 -m pip install qacraft==1.4.1
qacraft doctor
qacraft list

Start from a checkout

python3 -m pip install --no-deps -e .
qacraft doctor
qacraft list
python3 -m qacraft eval-list
qacraft release-check
python3 scripts/demo.py

Pip may create an isolated build environment to obtain the declared setuptools build backend. QACraft itself still installs with zero runtime dependencies because --no-deps is used.

The original python3 scripts/qacraft.py ... interface remains supported.

Build verified artifacts

Use the standard build frontend:

python3 -m pip install build
python3 -m build --sdist --wheel --outdir dist

Compatibility commands remain available when their build tools are installed:

python3 setup.py sdist --dist-dir dist
python3 -m pip wheel --no-deps --no-build-isolation --wheel-dir dist .

Install the built wheel locally:

python3 -m pip install --no-deps dist/qacraft-1.4.1-py3-none-any.whl
qacraft doctor

The wheel contains a generated qacraft/bundle/ assembled from an explicit allowlist during the temporary build. The repository keeps one canonical copy of every skill, policy, schema, rubric, fixture, and document.

The source distribution contains the canonical source tree and build recipe. Both artifact types are inspected, installed into isolated environments, and exercised through release checks, evaluation, and agent lifecycle tests.

Install into a verified agent

Each adapter uses an officially documented project skill location and a separate QACraft manifest.

The --destination must already exist and must be the intended project root. QACraft refuses a missing path instead of creating and populating a possibly mistyped destination. It may create only documented QACraft-owned subdirectories inside that existing root.

Preview:

qacraft install feature-qa bug-report \
  --agent github-copilot \
  --destination /path/to/existing-project

Apply:

qacraft install feature-qa bug-report \
  --agent github-copilot \
  --destination /path/to/existing-project \
  --apply

Replace github-copilot with any verified --agent value from the table. QACraft does not automatically detect an agent, install to user-global paths, or modify agent configuration files.

Verify, update, and uninstall

qacraft verify-install \
  --agent github-copilot \
  --destination /path/to/existing-project

qacraft update feature-qa bug-report release-qa \
  --agent github-copilot \
  --destination /path/to/existing-project \
  --apply

qacraft uninstall \
  --agent github-copilot \
  --destination /path/to/existing-project \
  --apply

Install, update, and uninstall are preview-only without --apply. Existing unowned files are never overwritten. Modified managed files block update and uninstall. Failed installs and updates roll back QACraft-managed changes. Independent manifests allow different adapters to coexist in one repository.

Evaluate structured QA reports

qacraft eval-list
qacraft evaluate \
  --input evaluations/examples/api-qa-pass.json

Deterministic rubrics are included for:

• /feature-qa
• /ticket-review
• /bug-report
• /verify-fix
• /release-qa
• /test-plan
• /regression-scope
• /customer-issue-repro
• /api-qa
• /staged-rollout-check

The evaluator checks schema conformance, source grounding, approval gates, evidence quality, verdict discipline, safety declarations, and output contracts. It does not call an AI model and does not prove that external evidence is authentic.

Published examples and targeted failure cases are declared in evaluations/fixtures.json. Release readiness evaluates every listed fixture and confirms that each failure case triggers its declared policy check.

Validate the repository

python3 scripts/generate_docs.py
python3 scripts/validate_repo.py
python3 -m unittest discover -s tests -v
qacraft release-check
python3 scripts/demo.py

Generated documentation must be committed. The pull-request workflow runs one Python 3.12 validation job.

Documentation

• Published documentation
• Installation and lifecycle
• Compatibility matrix
• Behavior evaluations
• Production readiness
• Publishing
• Phase 2 architecture
• Release checklist
• Changelog
• HTML documentation: docs/index.html

Serve the HTML documentation locally:

python3 scripts/serve.py

The published site is deployed by .github/workflows/pages.yml.

Skill catalog

Planning and scope

/ticket-review · /test-plan · /regression-scope · /platform-matrix

Execution and product behaviour

/feature-qa · /exploratory-qa · /smoke-test · /permission-qa · /api-qa · /network-qa · /offline-qa · /playback-qa

Defects and verification

/bug-report · /bug-triage · /verify-fix · /customer-issue-repro · /flaky-test-triage

Release and operations

/release-qa · /staged-rollout-check · /incident-qa

Automation and maintenance

/automation-review · /test-case-review

Communication and improvement

/qa-daily-summary · /qa-handoff · /qa-retrospective

Safety model

QACraft skills are instructions and specifications—not a permission system.

Production adopters must enforce:

• least-privilege filesystem, command, repository, browser, and network permissions
• secret isolation and customer-data controls
• authenticated, version-bound approval gates
• evidence privacy, integrity, access, retention, and deletion controls
• idempotent, conflict-aware external writes
• monitoring, audit logs, incident response, and rollback

Never grant production, customer, or security-sensitive access merely because a skill describes safe behavior.

Repository structure

QACraft/
├── adapters/
├── catalog/
├── docs/
├── evaluations/
├── qacraft/
├── schemas/
├── scripts/
├── shared/
├── skills/
├── tests/
├── .github/workflows/
├── MANIFEST.in
├── qacraft_build.py
├── setup.py
├── AGENTS.md
├── CLAUDE.md
├── CHANGELOG.md
├── CONTRIBUTING.md
├── SECURITY.md
└── README.md

License

MIT